TIERED ACCESS TO REGIONS OF INTEREST IN VIDEO FRAMES
Various systems and methods for implementing tiered access to regions of interest in video frames are described herein. A system for implementing tiered access to regions of interest in video frames, comprising: a memory device to store a mapping table, the mapping table to store a correspondence between a protection level and a consumer; video processing circuitry to: compress a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks; and encrypt each block in each frame of the video stream using an encryption key; and inference circuitry to: use an object detection and classification process on the video stream to identify an object in the video stream; access a policy store to determine a corresponding protection level for the object; and store the corresponding protection level in lossless video compression metadata.
Embodiments described herein generally relate to video processing systems and in particular, to a system that performs tiered access to regions of interest in video frames.
BACKGROUNDEdge computing, at a general level, refers to the transition of compute and storage resources closer to endpoint devices (e.g., consumer computing devices, user equipment, etc.) in order to optimize total cost of ownership, reduce application latency, improve service capabilities, and improve compliance with security or data privacy requirements. Edge computing may, in some scenarios, provide a cloud-like distributed service that offers orchestration and management for applications among many types of storage and compute resources. As a result, some implementations of edge computing have been referred to as the “edge cloud” or the “fog”, as powerful computing resources previously available only in large remote data centers are moved closer to endpoints and made available for use by consumers at the “edge” of the network.
Edge computing use cases in mobile network settings have been developed for integration with multi-access edge computing (MEC) approaches, also known as “mobile edge computing.” MEC approaches are designed to allow application developers and content providers to access computing capabilities and an information technology (IT) service environment in dynamic mobile network settings at the edge of the network. Limited standards have been developed by the European Telecommunications Standards Institute (ETSI) industry specification group (ISG) in an attempt to define common interfaces for operation of MEC systems, platforms, hosts, services, and applications.
Edge computing, MEC, and related technologies attempt to provide reduced latency, increased responsiveness, and more available computing power than offered in traditional cloud network services and wide area network connections. However, the integration of mobility and dynamically launched services to some mobile use and device processing use cases has led to limitations and concerns with orchestration, functional coordination, and resource management, especially in complex mobility settings where many participants (devices, hosts, tenants, service providers, operators) are involved. In a similar manner, Internet of Things (IoT) networks and devices are designed to offer a distributed compute arrangement, from a variety of endpoints. IoT devices are physical or virtualized objects that may communicate on a network, and may include sensors, actuators, and other input/output components, which may be used to collect data or perform actions in a real world environment. For example, IoT devices may include low-powered endpoint devices that are embedded or attached to everyday things, such as buildings, vehicles, packages, etc., to provide an additional level of artificial sensory perception of those things. Recently, IoT devices have become more popular and thus applications using these devices have proliferated.
The deployment of various Edge, Fog, MEC, and IoT networks, devices, and services have introduced a number of advanced use cases and scenarios occurring at and towards the edge of the network. However, these advanced use cases have also introduced a number of corresponding technical challenges relating to security, processing and network resources, service availability and efficiency, among many other issues, especially as more types of computing systems and configurations are deployed. One such challenge is in relation to security and trust, and the operational states of software programs and data, as represented in memory (e.g., DRAM memory), cache memory (e.g., in a cache), or registers (e.g., CPU, or GPU).
in the drawings, which are not necessarily drawn to scale, like numerals may describe similar components in different views. Like numerals having different letter suffixes may represent different instances of similar components. Some embodiments are illustrated by way of example, and not limitation, in the figures of the accompanying drawings in which:
Systems and methods described herein provide a system that provides tiered access to regions of interest in video frames. In various examples, the systems and methods described herein enforce selective access rights to virtual machines that share hardware resources and decoded camera streams. Such a mechanism improves privacy of protection measures of people or things captured in video streams.
A system on chip (SoC) may include multiple virtual machine (VM) instances. Each VM has access to underlying hardware resources, which may include camera or video resources. Each VM may access the video stream and analyze it for different purposes. Camera stream and video stream are used interchangeably in this document and each refer to a time ordered series of images.
An example SoC may be used in a system where a camera stream is to be inferenced by multiple departments within a City's administration such as Transportation, Utilities, Education, and Public Safety. Based on an initial detection and classification of the objects, regions of interest are identified within a decoded video frame. The SoC must implement privacy protection measures such that each department in the City administration only has access to video data that it needs to and is allowed to access. The mechanism described in this document provide a hardware-based solution to this problem using existing SoC infrastructure thereby not impacting the overall performance of the system.
While one way to address this situation is to create multiple copies of the video stream, one copy per recipient, with each copy having privacy enforced using encryption or other obfuscation techniques. This way is resource intensive. It may involve the use of compute and memory to create the copies, screen them, transmit copies throughout the system, and control further distribution.
The present document. provides a mechanism that overloads the existing lossless compression metadata and associated infrastructure in a video stream to record the access protection level of blocks of pixels. A decoded frame is fully encrypted at the block boundaries. Metadata is used to record the required protection level of each block. Each VM on the SoC may have a corresponding protection level indicating which data is available to the VM. Selective description is implemented as the video stream is served to a receiving VM.
Because this technique utilizes existing SoC lossless compression infrastructure, it is straightforward to implement and validate in software. The overhead added is only about 3 KB of memory per 1080p frame. For instance, using a 16-pixel block size, and a 2-bit protection level field, the protection levels of the blocks in a 1080p frame is about 2 KB: ((1920/16)*(1080/16)*2)/8≈2 KB.
Further, reusing the existing compression infrastructure ensures that there is no performance penalty with this technique. Encrypting the video stream after lossless compression is applied results in a memory bandwidth efficiency. Implements are able to support more virtual machines that share the same hardware resources and access the same camera streams while enforcing strict hardware-based privacy protections.
Compute, memory, and storage are scarce resources, and generally decrease depending on the edge location (e.g., fewer processing resources being available at consumer endpoint devices, than at a base station, than at a central office). However, the closer that the edge location is to the endpoint (e.g., user equipment (UE)), the more that space and power is often constrained. Thus, edge computing attempts to reduce the amount of resources needed for network services, through the distribution of more resources which are located closer both geographically and in network access time. In this manner, edge computing attempts to bring the compute resources to the workload data where appropriate, or, bring the workload data to the compute resources.
The following describes aspects of an edge cloud architecture that covers multiple potential deployments and addresses restrictions that some network operators or service providers may have in their own infrastructures. These include, variation of configurations based on the edge location (because edges at a base station level, for instance, may have more constrained performance and capabilities in a multi-tenant scenario); configurations based on the type of compute, memory, storage, fabric, acceleration, or like resources available to edge locations, tiers of locations, or groups of locations; the service, security, and management and orchestration capabilities; and related objectives to achieve usability and performance of end services. These deployments may accomplish processing in network layers that may be considered as “near edge”, “close edge”, “local edge”, “middle edge”, or “far edge” layers, depending on latency, distance, and timing characteristics.
Edge computing is a developing paradigm where computing is performed at or closer to the “edge” of a network, typically through the use of a compute platform (e.g., x86 or ARM compute hardware architecture) implemented at base stations, gateways, network routers, or other devices which are much closer to endpoint devices producing and consuming the data. For example, edge gateway servers may be equipped with pools of memory and storage resources to perform computation in real-time for low latency use-cases (e.g., autonomous driving or video surveillance) for connected client devices. Or as an example, base stations may be augmented with compute and acceleration resources to directly process service workloads for connected user equipment, without further communicating data via backhaul networks. Or as another example, central office network management hardware may be replaced with standardized compute hardware that performs virtualized network functions and offers compute resources for the execution of services and consumer functions for connected devices. Within edge computing networks, there may be scenarios in services which the compute resource will be “moved” to the data, as well as scenarios in which the data will be “moved” to the compute resource. Or as an example, base station compute, acceleration and network resources can provide services in order to scale to workload demands on an as needed basis by activating dormant capacity (subscription, capacity on demand) in order to manage corner cases, emergencies or to provide longevity for deployed resources over a significantly longer implemented lifecycle.
Examples of latency, resulting from network communication distance and processing time constraints, may range from less than a millisecond (ms) when among the endpoint layer 200, under 5 ms at the edge devices layer 210, to even between 10 to 40 ms when communicating with nodes at the network access layer 220. Beyond the edge cloud 110 are core network 230 and cloud data center 240 layers, each with increasing latency (e.g., between 50-60 ms at the core network layer 230, to 100 or more ms at the cloud data center layer). As a result, operations at a core network data center 235 or a cloud data center 245, with latencies of at least 50 to 100 ms or more, will not be able to accomplish many time-critical functions of the use cases 205. Each of these latency values are provided for purposes of illustration and contrast; it will be understood that the use of other access network mediums and technologies may further reduce the latencies. In some examples, respective portions of the network may be categorized as “close edge”, “local edge”, “near edge”, “middle edge”, or “far edge” layers, relative to a network source and destination. For instance, from the perspective of the core network data center 235 or a cloud data center 245, a central office or content data network may be considered as being located within a “near edge” layer (“near” to the cloud, having high latency values when communicating with the devices and endpoints of the use cases 205), whereas an access point, base station, on-premise server, or network gateway may be considered as located within a “far edge” layer (“far” from the cloud, having low latency values when communicating with the devices and endpoints of the use cases 205). It will be understood that other categorizations of a particular network layer as constituting a “close”, “local”, “near”, “middle”, or “far” edge may be based on latency, distance, number of network hops, or other measurable characteristics, as measured from a source in any of the network layers 200-240.
The various use cases 205 may access resources under usage pressure from incoming streams, due to multiple services utilizing the edge cloud. To achieve results with low latency, the services executed within the edge cloud 110 balance varying requirements in terms of: (a) Priority (throughput or latency) and Quality of Service (QoS) (e.g., traffic for an autonomous car may have higher priority than a temperature sensor in terms of response time requirement; or, a performance sensitivity/bottleneck may exist at a compute/accelerator, memory, storage, or network resource, depending on the application); (b) Reliability and Resiliency (e.g., some input streams need to be acted upon and the traffic routed with mission-critical reliability, where as some other input streams may be tolerate an occasional failure, depending on the application); and (c) Physical constraints (e.g., power, cooling and form-factor).
The end-to-end service view for these use cases involves the concept of a service-flow and is associated with a transaction. The transaction details the overall service requirement for the entity consuming the service, as well as the associated services for the resources, workloads, workflows, and business functional and business level requirements. The services executed with the “terms” described may be managed at each layer in a way to assure real time, and runtime contractual compliance for the transaction during the lifecycle of the service. When a component in the transaction is missing its agreed to SLA, the system as a whole (components in the transaction) may provide the ability to (1) understand the impact of the SLA violation, and (2) augment other components in the system to resume overall transaction SLA, and (3) implement steps to remediate.
Thus, with these variations and service features in mind, edge computing within the edge cloud 110 may provide the ability to serve and respond to multiple applications of the use cases 205 (e.g., object tracking, video surveillance, connected cars, etc.) in real-time or near real-time, and meet ultra-low latency requirements for these multiple applications. These advantages enable a whole new class of applications (Virtual Network Functions (VNFs), Function as a Service (FaaS), Edge as a Service (EaaS), standard processes, etc.), which cannot leverage conventional cloud computing due to latency or other limitations.
However, with the advantages of edge computing comes the following caveats. The devices located at the edge are often resource constrained and therefore there is pressure on usage of edge resources. Typically, this is addressed through the pooling of memory and storage resources for use by multiple users (tenants) and devices. The edge may be power and cooling constrained and therefore the power usage needs to be accounted for by the applications that are consuming the most power. There may be inherent power-performance tradeoffs in these pooled memory resources, as many of them are likely to use emerging memory technologies, where more power requires greater memory bandwidth. Likewise, improved security of hardware and root of trust trusted functions are also required, because edge locations may be unmanned and may even need permissioned access (e.g., when housed in a third-party location). Such issues are magnified in the edge cloud 110 in a multi-tenant, multi-owner, or multi-access setting, where services and applications are requested by many users, especially as network usage dynamically fluctuates and the composition of the multiple stakeholders, use cases, and services changes.
At a more generic level, an edge computing system may be described to encompass any number of deployments at the previously discussed layers operating in the edge cloud 110 (network layers 200-240), which provide coordination from client and distributed computing devices. One or more edge gateway nodes, one or more edge aggregation nodes, and one or more core data centers may be distributed across layers of the network to provide an implementation of the edge computing system by or on behalf of a telecommunication service provider (“telco”, or “TSP”), internet-of-things service provider, cloud service provider (CSP), enterprise entity, or any other number of entities. Various implementations and configurations of the edge computing system may be provided dynamically, such as when orchestrated to meet service objectives.
Consistent with the examples provided herein, a client compute node may be embodied as any type of endpoint component, device, appliance, or other thing capable of communicating as a producer or consumer of data. Further, the label “node” or “device” as used in the edge computing system does not necessarily mean that such node or device operates in a client or agent/minion/follower role; rather, any of the nodes or devices in the edge computing system refer to individual entities, nodes, or subsystems which include discrete or connected hardware or software configurations to facilitate or use the edge cloud 110.
As such, the edge cloud 110 is formed from network components and functional features operated by and within edge gateway nodes, edge aggregation nodes, or other edge compute nodes among network layers 210-230. The edge cloud 110 thus may be embodied as any type of network that provides edge computing and/or storage resources which are proximately located to radio access network (RAN) capable endpoint devices (e.g., mobile computing devices, IoT devices, smart devices, etc.), which are discussed herein. In other words, the edge cloud 110 may be envisioned as an “edge” which connects the endpoint devices and traditional network access points that serve as an ingress point into service provider core networks, including mobile carrier networks (e.g., Global System for Mobile Communications (GSM) networks, Long-Term Evolution (LTE) networks, 5G/6G networks, etc.), while also providing storage and/or compute capabilities. Other types and forms of network access (e.g., Wi-Fi, long-range wireless, wired networks including optical networks) may also be utilized in place of or in combination with such 3GPP carrier networks.
The network components of the edge cloud 110 may be servers, multi-tenant servers, appliance computing devices, and/or any other type of computing devices, For example, the edge cloud 110 may include an appliance computing device that is a self-contained electronic device including a housing, a chassis, a case or a shell. In some circumstances, the housing may be dimensioned for portability such that it can he carried by a human and/or shipped. Example housings may include materials that form one or more exterior surfaces that partially or fully protect contents of the appliance, in which protection may include weather protection, hazardous environment protection (e.g., EMI, vibration, extreme temperatures), and/or enable submergibility. Example housings may include power circuitry to provide power for stationary and/or portable implementations, such as AC power inputs, DC power inputs, AC/DC or DC/AC converter(s), power regulators, transformers, charging circuitry, batteries, wired inputs and/or wireless power inputs. Example housings and/or surfaces thereof may include or connect to mounting hardware to enable attachment to structures such as buildings, telecommunication structures (e.g., poles, antenna structures, etc.) and/or racks (e.g., server racks, blade mounts, etc.). Example housings and/or surfaces thereof may support one or more sensors (e.g., temperature sensors, vibration sensors, light sensors, acoustic sensors, capacitive sensors, proximity sensors, etc.). One or more such sensors may be contained in, carried by, or otherwise embedded in the surface and/or mounted to the surface of the appliance. Example housings and/or surfaces thereof may support mechanical connectivity, such as propulsion hardware (e.g., wheels, propellers, etc.) and/or articulating hardware (e.g., robot arms, pivotable appendages, etc.). In some circumstances, the sensors may include any type of input devices such as user interface hardware (e.g., buttons, switches, sliders, etc.). In some circumstances, example housings include output devices contained in, carried by, embedded therein and/or attached thereto. Output devices may include displays, touchscreens, lights, LEDs, speakers, I/O ports (e.g., USB), etc. In some circumstances, edge devices are devices presented in the network for a specific purpose (e.g., a traffic light), but may have processing and/or other capacities that may be utilized for other purposes. Such edge devices may be independent from other networked devices and may be provided with a housing having a form factor suitable for its primary purpose; yet be available for other compute tasks that do not interfere with its primary task. Edge devices include Internet of Things devices. The appliance computing device may include hardware and software components to manage local issues such as device temperature, vibration, resource utilization, updates, power issues, physical and network security, etc. Example hardware for implementing an appliance computing device is described in conjunction with
In
In further examples, any of the compute nodes or devices discussed with reference to the present edge computing systems and environment may be fulfilled based on the components depicted in
In the simplified example depicted in
The compute node 400 may be embodied as any type of engine, device, or collection of devices capable of performing various compute functions. In some examples, the compute node 400 may be embodied as a single device such as an integrated circuit, an embedded system, a field-programmable gate array (FPGA), a system-on-a-chip (SoC), or other integrated system or device. In the illustrative example, the compute node 400 includes or is embodied as a processor 404 and a memory 406. The processor 404 may be embodied as any type of processor capable of performing the functions described herein (e.g., executing an application). For example, the processor 404 may be embodied as a multi-core processor(s), a microcontroller, a processing unit, a specialized or special purpose processing unit, or other processor or processing/controlling circuit.
In some examples, the processor 404 may be embodied as, include, or be coupled to an FPGA, an application specific integrated circuit (ASIC), reconfigurable hardware or hardware circuitry, or other specialized hardware to facilitate performance of the functions described herein. Also, in some examples, the processor 404 may be embodied as a specialized x-processing unit (xPU) also known as a data processing unit (DPU), infrastructure processing unit (IPU), or network processing unit (NPU). Such an xPU may be embodied as a standalone circuit or circuit package, integrated within an SoC, or integrated with networking circuitry (e.g., in a SmartNIC, or enhanced SmartNIC), acceleration circuitry, storage devices, or AI hardware (e.g., GPUs or programmed FPGAs). Such an xPU may be designed to receive programming to process one or more data streams and perform specific tasks and actions for the data streams (such as hosting microservices, performing service management or orchestration, organizing or managing server or data center hardware, managing service meshes, or collecting and distributing telemetry), outside of the CPU or general purpose processing hardware. However, it will be understood that a xPU, a SoC, a CPU, and other variations of the processor 404 may work in coordination with each other to execute many types of operations and instructions within and on behalf of the compute node 400.
The memory 406 may be embodied as any type of volatile (e.g., dynamic random access memory (DRAM), etc.) or non-volatile memory or data storage capable of performing the functions described herein. Volatile memory may be a storage medium that requires power to maintain the state of data stored by the medium. Non-limiting examples of volatile memory may include various types of random access memory (RAM), such as DRAM or static random access memory (SRAM). One particular type of DRAM that may be used in a memory module is synchronous dynamic random access memory (SDRAM).
In an example, the memory device is a block addressable memory device, such as those based on NAND or NOR technologies. A memory device may also include a three dimensional crosspoint memory device (e.g., Intel® 3D XPoint™ memory), or other byte addressable write-in-place nonvolatile memory devices. The memory device may refer to the die itself and/or to a packaged memory product. In some examples, 3D crosspoint memory (e.g., Intel® 3D Xpoint™ memory) may comprise a transistor-less stackable cross point architecture in which memory cells sit at the intersection of word lines and bit lines and are individually addressable and in which bit storage is based on a change in bulk resistance. In some examples, all or a portion of the memory 406 may be integrated into the processor 404. The memory 406 may store various software and data used during operation such as one or more applications, data operated on by the application(s), libraries, and drivers.
The compute circuitry 402 is communicatively coupled to other components of the compute node 400 via the I/O subsystem 408, which may be embodied as circuitry and/or components to facilitate input/output operations with the compute circuitry 402 (e.g., with the processor 404 and/or the main memory 406) and other components of the compute circuitry 402. For example, the I/O subsystem 408 may be embodied as, or otherwise include, memory controller hubs, input/output control hubs, integrated sensor hubs, firmware devices, communication links (e.g., point-to-point links, bus links, wires, cables, light guides, printed circuit board traces, etc.), and/or other components and subsystems to facilitate the input/output operations. In some examples, the I/O subsystem 408 may form a portion of a system-on-a-chip (SoC) and be incorporated, along with one or more of the processor 404, the memory 406, and other components of the compute circuitry 402, into the compute circuitry 402.
The one or more illustrative data storage devices 410 may be embodied as any type of devices configured for short-term or long-term storage of data such as, for example, memory devices and circuits, memory cards, hard disk drives, solid-state drives, or other data storage devices. Individual data storage devices 410 may include a system partition that stores data and firmware code for the data storage device 410. Individual data storage devices 410 may also include one or more operating system partitions that store data files and executables for operating systems depending on, for example, the type of compute node 400.
The communication circuitry 412 may be embodied as any communication circuit, device, or collection thereof, capable of enabling communications over a network between the compute circuitry 402 and another compute device (e.g., an edge gateway of an implementing edge computing system). The communication circuitry 412 may be configured to use any one or more communication technology (e.g., wired or wireless communications) and associated protocols (e.g., a cellular networking protocol such a 3GPP 4G or 5G standard, a wireless local area network protocol such as IEEE 802.11/Wi-Fi®, a wireless wide area network protocol, Ethernet, Bluetooth®, Bluetooth Low Energy, a IoT protocol such as IEEE 802.15.4 or ZigBee®, low-power wide-area network (LPWAN) or low-power wide-area (LPWA) protocols, etc.) to effect such communication.
The illustrative communication circuitry 412 includes a network interface controller (NIC) 420, which may also be referred to as a host fabric interface (HFI). The NIC 420 may be embodied as one or more add-in-boards, daughter cards, network interface cards, controller chips, chipsets, or other devices that may be used by the compute node 400 to connect with another compute device (e.g., an edge gateway node). In some examples, the NIC 420 may be embodied as part of a system-on-a-chip (SoC) that includes one or more processors, or included on a multichip package that also contains one or more processors. In some examples, the NIC 420 may include a local processor (not shown) and/or a local memory (not shown) that are both local to the NIC 420. In such examples, the local processor of the NIC 420 may be capable of performing one or more of the functions of the compute circuitry 402 described herein. Additionally, or alternatively, in such examples, the local memory of the NIC 420 may be integrated into one or more components of the client compute node at the board level, socket level, chip level, and/or other levels.
Additionally, in some examples, a respective compute node 400 may include one or more peripheral devices 414. Such peripheral devices 414 may include any type of peripheral device found in a compute device or server such as audio input devices, a display, other input/output devices, interface devices, and/or other peripheral devices, depending on the particular type of the compute node 400. In further examples, the compute node 400 may be embodied by a respective edge compute node (whether a client, gateway, or aggregation node) in an edge computing system or like forms of appliances, computers, subsystems, circuitry, or other components.
In a more detailed example,
The edge computing node 450 may include processing circuitry in the form of a processor 452, which may be a microprocessor, a multi-core processor, a multithreaded processor, an ultra-low voltage processor, an embedded. processor, an xPU/DPU/IPU/NPU, special purpose processing unit, specialized processing unit, or other known processing elements. The processor 452 may be a part of a system on a chip (SoC) in which the processor 452 and other components are formed into a single integrated circuit, or a single package, such as the Edison™ or Galileo™ SoC boards from Intel Corporation, Santa Clara, Calif. As an example, the processor 452 may include an Intel® Architecture Core™ based CPU processor, such as a Quark™, an Atom™, an i3, an i5, an i7, an i9, or an MCU-class processor, or another such processor available from Intel®. However, any number other processors may be used, such as available from Advanced Micro Devices, Inc. (AMD®) of Sunnyvale, Calif., a MIPS®-based design from MIPS Technologies, Inc. of Sunnyvale, Calif., an ARM®-based design licensed from ARM Holdings, Ltd. or a customer thereof, or their licensees or adopters. The processors may include units such as an A5-13 processor from Apple® Inc., a Snapdragon™ processor from Qualcomm® Technologies, Inc., or an OMAP™ processor from Texas Instruments, Inc. The processor 452 and accompanying circuitry may be provided in a single socket form factor, multiple socket form factor, or a variety of other formats, including in limited hardware configurations or configurations that include fewer than all elements shown in
The processor 452 may communicate with a system memory 454 over an interconnect 456 (e.g., a bus). Any number of memory devices may be used to provide for a given amount of system memory. As examples, the memory 454 may be random access memory (RAM) in accordance with a Joint Electron Devices Engineering Council (JEDEC) design such as the DDR or mobile DDR standards (e.g., LPDDR, LPDDR2, LPDDR3, or LPDDR4). In particular examples, a memory component may comply with a DRAM standard promulgated by JEDEC, such as JESD79F for DDR SDRAM, JESD79-2F for DDR2 SDRAM, JESD79-3F for DDR3 SDRAM, JESD79-4A for DDR4 SDRAM, JESD209 for Low Power DDR (LPDDR), JESD209-2 for LPDDR2, JESD209-3 for LPDDR3, and JESD209-4 for LPDDR4. Such standards (and similar standards) may be referred to as DDR-based standards and communication interfaces of the storage devices that implement such standards may be referred to as DDR-based interfaces. In various implementations, the individual memory devices may be of any number of different package types such as single die package (SDP), dual die package (DDP) or quad die package (Q17P). These devices, in some examples, may be directly soldered onto a motherboard to provide a lower profile solution, while in other examples the devices are configured as one or more memory modules that in turn couple to the motherboard by a given connector. Any number of other memory implementations may be used, such as other types of memory modules, e.g., dual inline memory modules (DIMMs) of different varieties including but not limited to microDIMMs or MiniDIMMs.
To provide for persistent storage of information such as data, applications, operating systems and so forth, a storage 458 may also couple to the processor 452 via the interconnect 456. In an example, the storage 458 may be implemented via a solid-state disk drive (SSDD). Other devices that may be used for the storage 458 include flash memory cards, such as Secure Digital (SD) cards, microSD cards, eXtreme Digital (XD) picture cards, and the like, and Universal Serial Bus (USB) flash drives. In an example, the memory device may be or may include memory devices that use chalcogenide glass, multi-threshold level NAND flash memory, NOR flash memory, single or multi-level Phase Change Memory (PCM), a resistive memory, nanowire memory, ferroelectric transistor random access memory (FeTRAM), anti-ferroelectric memory, magnetoresistive random access memory (MRAM) memory that incorporates memristor technology, resistive memory including the metal oxide base, the oxygen vacancy base and the conductive bridge Random Access Memory (CB-RAM), or spin transfer torque (STT)-MRAM, a spintronic magnetic junction memory based device, a magnetic tunneling junction (MTJ) based device, a DW (Domain Wall) and SOT (Spin Orbit Transfer) based device, a thyristor based memory device, or a combination of any of the above, or other memory.
In low power implementations, the storage 458 may be on-die memory or registers associated with the processor 452. However, in some examples, the storage 458 may be implemented using a micro hard disk drive (HDD). Further, any number of new technologies may be used for the storage 458 in addition to, or instead of, the technologies described, such resistance change memories, phase change memories, holographic memories, or chemical memories, among others.
The components may communicate over the interconnect 456. The interconnect 456 may include any number of technologies, including industry standard architecture (ISA), extended ISA (EISA), peripheral component interconnect (PCI), peripheral component interconnect extended (PCIx), PCI express (PCIe), or any number of other technologies. The interconnect 456 may be a proprietary bus, for example, used in an SoC based system. Other bus systems may be included, such as an inter-integrated Circuit (I2C) interface, a Serial Peripheral Interface (SPI) interface, point to point interfaces, and a power bus, among others.
The interconnect 456 may couple the processor 452 to a transceiver 466, for communications with the connected edge devices 462. The transceiver 466 may use any number of frequencies and protocols, such as 2.4 Gigahertz (GHz) transmissions under the IEEE 802.15.4 standard, using the Bluetooth® low energy (BLE) standard, as defined by the Bluetooth® Special Interest Group, or the ZigBee® standard, among others. Any number of radios, configured for a particular wireless communication protocol, may be used for the connections to the connected edge devices 462. For example, a wireless local area network (WLAN) unit may be used to implement Wi-Fi® communications in accordance with the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard. In addition, wireless wide area communications, e.g., according to a cellular or other wireless wide area protocol, may occur via a wireless wide area network (WWAN) unit.
The wireless network transceiver 466 (or multiple transceivers) may communicate using multiple standards or radios for communications at a different range. For example, the edge computing node 450 may communicate with close devices, e.g., within about 10 meters, using a local transceiver based on Bluetooth Low Energy (BLE), or another low power radio, to save power. More distant connected edge devices 462, e.g., within about 50 meters, may be reached over ZigBee® or other intermediate power radios. Both communications techniques may take place over a single radio at different power levels or may take place over separate transceivers, for example, a local transceiver using BLE and a separate mesh transceiver using ZigBee®.
A wireless network transceiver 466 (e.g., a radio transceiver) may be included to communicate with devices or services in a cloud (e.g., an edge cloud 495) via local or wide area network protocols. The wireless network transceiver 466 may be a low-power wide-area (LPWA) transceiver that follows the IEEE 802.15.4, or IEEE 802.15.4g standards, among others. The edge computing node 450 may communicate over a wide area using LoRaWAN™ (Long Range Wide Area Network) developed by Semtech and the LoRa Alliance. The techniques described herein are not limited to these technologies but may be used with any number of other cloud transceivers that implement long range, low bandwidth communications, such as Sigfox, and other technologies. Further, other communications techniques, such as time-slotted channel hopping, described in the IEEE 802.15.4e specification may be used.
Any number of other radio communications and protocols may be used in addition to the systems mentioned for the wireless network transceiver 466, as described herein. For example, the transceiver 466 may include a cellular transceiver that uses spread spectrum (SPA/SAS) communications for implementing high-speed communications. Further, any number of other protocols may be used, such as Wi-Fi® networks for medium speed communications and provision of network communications. The transceiver 466 may include radios that are compatible with any number of 3GPP (Third Generation Partnership Project) specifications, such as Long Term Evolution (LTE) and 5th Generation (5G) communication systems, discussed in further detail at the end of the present disclosure. A network interface controller (NIC) 468 may be included to provide a wired communication to nodes of the edge cloud 495 or to other devices, such as the connected edge devices 462 (e.g., operating in a mesh). The wired communication may provide an Ethernet connection or may be based on other types of networks, such as Controller Area Network (CAN), Local Interconnect Network (LIN), DeviceNet, ControlNet, Data Highway+, PROFIBUS, or PROHNET, among many others. An additional NIC 468 may be included to enable connecting to a second network, for example, a first NIC 468 providing communications to the cloud over Ethernet, and a second NIC 468 providing communications to other devices over another type of network.
Given the variety of types of applicable communications from the device to another component or network, applicable communications circuitry used by the device may include or be embodied by any one or more of components 464, 466, 468, or 470. Accordingly, in various examples, applicable means for communicating (e.g., receiving, transmitting, etc.) may be embodied by such communications circuitry.
The edge computing node 450 may include or be coupled to acceleration circuitry 464, which may be embodied by one or more artificial intelligence (AI) accelerators, a neural compute stick, neuromorphic hardware, to FPGA, an arrangement of GPUs, an arrangement of xPUs/DPUs/IPU/NPUs, one or more SoCs, one or more CPUs, one or more digital signal processors, dedicated ASICs, or other forms of specialized processors or circuitry designed to accomplish one or more specialized tasks. These tasks may include AI processing (including machine learning, training, inferencing, and classification operations), visual data processing, network data processing, object detection, rule analysis, or the like. These tasks also may include the specific edge computing tasks for service management and service operations discussed elsewhere in this document.
The interconnect 456 may couple the processor 452 to a sensor huh or external interface 470 that is used to connect additional devices or subsystems. The devices may include sensors 472, such as accelerometers, level sensors, flow sensors, optical light sensors, camera sensors, temperature sensors, global navigation system (e.g., GPS) sensors, pressure sensors, barometric pressure sensors, and the like. The hub or interface 470 further may be used to connect the edge computing node 450 to actuators 474, such as power switches, valve actuators, an audible sound generator, a visual warning device, and the like.
In some optional examples, various input/output (I/O) devices may be present within or connected to, the edge computing node 450. For example, a display or other output device 484 may be included to show information, such as sensor readings or actuator position. An input device 486, such as a touch screen or keypad may be included to accept input. An output device 484 may include any number of forms of audio or visual display, including simple visual outputs such as binary status indicators (e.g., light-emitting diodes (LEDs)) and multi-character visual outputs, or more complex outputs such as display screens (e.g., liquid crystal display (LCD) screens), with the output of characters, graphics, multimedia objects, and the like being generated or produced from the operation of the edge computing node 450. A display or console hardware, in the context of the present system, may be used to provide output and receive input of an edge computing system; to manage components or services of an edge computing system; identify a state of an edge computing component or service; or to conduct any other number of management or administration functions or service use cases.
A battery 476 may power the edge computing node 450, although, in examples in which the edge computing node 450 is mounted in a fixed location, it may have a power supply coupled to an electrical grid, or the battery may be used as a backup or for temporary capabilities. The battery 476 may be a lithium ion battery, or a metal-air battery, such as a zinc-air battery, an aluminum-air battery, a lithium-air battery, and the like.
A battery monitor/charger 478 may be included in the edge computing node 450 to track the state of charge (SoCh) of the battery 476, if included. The battery monitor/charger 478 may be used to monitor other parameters of the battery 476 to provide failure predictions, such as the state of health (SoH) and the state of function (SoF) of the battery 476. The battery monitor/charger 478 may include a battery monitoring integrated circuit, such as an LTC4020 or an LTC2990 from Linear Technologies, an ADT7488A from ON Semiconductor of Phoenix Ariz., or an IC from the UCD90xxx family from Texas Instruments of Dallas, Tex. The battery monitor/charger 478 may communicate the information on the battery 476 to the processor 452 over the interconnect 456. The battery monitor/charger 478 may also include an analog-to-digital (ADC) converter that enables the processor 452 to directly monitor the voltage of the battery 476 or the current flow from the battery 476. The battery parameters may be used to determine actions that the edge computing node 450 may perform, such as transmission frequency, mesh network operation, sensing frequency, and the like.
A power block 480, or other power supply coupled to a grid, may be coupled with the battery monitor/charger 478 to charge the battery 476. In some examples, the power block 480 may be replaced with a wireless power receiver to obtain the power wirelessly, for example, through a loop antenna in the edge computing node 450. A wireless battery charging circuit, such as an LTC4020 chip from Linear Technologies of Milpitas, Calif., among others, may be included in the battery monitor/charger 478. The specific charging circuits may be selected based on the size of the battery 476, and thus, the current required. The charging may be performed using the Airfuel standard promulgated by the Airfuel Alliance, the Qi wireless charging standard promulgated by the Wireless Power Consortium, or the Rezence charging standard, promulgated by the Alliance for Wireless Power, among others.
The storage 458 may include instructions 482 in the form of software, firmware, or hardware commands to implement the techniques described herein. Although such instructions 482 are shown as code blocks included in the memory 454 and the storage 458, it may be understood that any of the code blocks may be replaced with hardwired circuits, for example, built into an application specific integrated circuit (ASIC).
In an example, the instructions 482 provided via the memory 454, the storage 458, or the processor 452 may be embodied as a non-transitory, machine-readable medium 460 including code to direct the processor 452 to perform electronic operations in the edge computing node 450. The processor 452 may access the non-transitory, machine-readable medium 460 over the interconnect 456. For instance, the non-transitory, machine-readable medium 460 may be embodied by devices described for the storage 458 or may include specific storage units such as optical disks, flash drives, or any number of other hardware devices. The non-transitory, machine-readable medium 460 may include instructions to direct the processor 452 to perform a specific sequence or flow of actions, for example, as described with respect to the flowchart(s) and block diagram(s) of operations and functionality depicted above. As used herein, the terms “machine-readable medium” and “computer-readable medium” are interchangeable.
Also, in a specific example, the instructions 482 on the processor 452 (separately, or in combination with the instructions 482 of the machine readable medium 460) may configure execution or operation of a trusted execution environment (TEE) 490. In an example, the TEE 490 operates as a protected area accessible to the processor 452 for secure execution of instructions and secure access to data. Various implementations of the TEE 490, and an accompanying secure area in the processor 452 or the memory 454 may be provided, for instance, through use of Intel® Software Guard Extensions (SGX) or ARM® TrustZone® hardware security extensions, Intel® Management. Engine (ME), or Intel® Converged Security Manageability Engine (CSME). Other aspects of security hardening, hardware roots-of-trust, and trusted or protected operations may be implemented in the node 450 through the TEE 490 and the processor 452.
In an embodiment, the video decoder 502 outputs YUV. YUV is a color encoding system typically used as part of a color image pipeline. It encodes a color image or video taking human perception into account, allowing reduced bandwidth for chrominance components, thereby typically enabling transmission errors or compression artifacts to be more efficiently masked by the human perception than using a “direct” RGB-representation.
The video stream output by the video decoder 502 is transmitted to a video processor 504. The video processor 504 includes a lossless memory compression circuitry 506, encryption circuitry 508, and a metadata controller 510.
The lossless compression circuitry 506 may be designed, programmed, adapted, or otherwise configured to apply a lossless compression to the video stream in order to reduce its data size. Data compressed using lossless data compression algorithms are fully recoverable and perfectly reconstructed when decompressed. In contrast, lossy data compression only allows for an approximation of the original data when decompressed. The lossless compression circuitry 506 may implement one or more of several types of lossless compression algorithms, including but not limited to H.264 lossless (e.g., x264), H.265 lossless (e.g., x265), Motion JPEG 2000 lossless, or the like.
The encoded video stream is then encrypted by the encryption circuitry 508. Various encryption standards may be used. In an embodiment, the encoded video stream is encrypted using an AES 128-bit cipher at 4×4 pixel block boundaries. In another embodiment, the encoded video stream is encrypted using an AES 256-bit cipher at 4×4 pixel block boundaries. It is understood that the block size may be 4, 8, 16, or 32 pixels.
The metadata controller 510 assigns a default protection level for each block. The default protection is at the lowest level of protection, which allows any consumer to access each block. The protection level is changed later in the process depending on a region of interest (RoI) in which the block exists.
The metadata controller 510 may overload the existing lossless compression metadata and associated infrastructure to record the access protection level of each N×N block of pixels. Depending on the level of protection levels, a small number of bits are needed. For instance, with four protection levels only two bits are needed for each block in a frame. This accounts for less than 2 KB of memory requirements. It is understood that additional protection levels may be used in which case, additional bits are required to store the assigned protection level for a block.
As is shown in the frame 512, a number of regions of interest 514A, 514B, and 514C are detected. The frame 512 is divided into some number of blocks based on the block size. Each block may include one or more RoIs.
A global mapping table 516 is used to track the protection levels used in the environment 500 and map the protection levels to consumers. Each consumer is assigned or associated with a unique identifier. In a virtualized system, the host software may assign each virtual machine a unique identifier. In this example, consumers are virtual machines or virtual devices on an SoC. In other examples, the consumers may be distinct physical machines or devices.
An inference accelerator 518 is used to analyze each frame of the video stream to detect and classify RoIs. The inference accelerator 518 decrypts the blocks in the frame, decompresses the frame (e.g., using an appropriate decoder such as FFmpeg, based on the encoder used), and performs an inference on the frame using an artificial intelligence (AI) accelerator. The AI accelerator may be hardware that is designed, programmed, adapted, or otherwise configured to detect, classify, and identify RoIs or objects in a video frame. For instance, the AI accelerator may classify objects generally, such as “an automobile” or “a street sign”, or classify and recognize objects with more specificity, such as “person” identified as “John Smith” or “a license plate” with the value “ABC-001”.
Based on a classification of the RoI and a security policy, the inference accelerator 518 assigns a protection level to each block of the video frame. The protection level is based on the contents of the RoI. The security policy be designed by an administrative user, by a machine-learning algorithm, or by some other mechanism that associates a type of RoI with a protection level. The block may have more than one RoI. In this case, the block may be assigned the most restrictive protection level.
The protection level may be stored in existing lossless compression metadata and associated infrastructure. Two, three, or more bits may be reserved for the protection level in the metadata record structure. The number of bits used is based on the number of distinct protection levels in the security scheme.
As an example, a city may have several departments that consume video content of a street scene for different reasons. The police department may be granted the highest permission level, while the utilities department and waste management department may be granted a lower level of permission. While license plates on vehicles that appear in the scene may be useful and made visible to the members of the police department, license plates are not useful for the utilities department and there is no reason to provide such sensitive information to the waste management department. The state or condition of a fire hydrant that appears in the scene may be un-obfuscated for the utilities department, but people in the scene may be obfuscated.
In an embodiment, each protection level is associated with a dedicated encryption key pair. Consumers, such as virtual devices or virtual machines, are assigned a key pair corresponding to their privilege and associated protection level. As a result, consumers who access the video stream data are only able to decrypt blocks that are assigned a protection level less than or equal to the protection level assigned to the consumer.
A virtual machine or virtual device 520 accesses the video stream. In an embodiment where all of the blocks are encrypted using a single encryption key, the decryption circuitry 522 accesses the global mapping table to determine which protection levels are accessible by the virtual machine 520. After obtaining the permissions, the decryption circuitry 522 decrypts blocks that are at or less than the privilege level assigned to the virtual machine 520. By leaving those blocks that have a higher privilege encrypted, the end user is not able to view the data that is associated with a higher privilege.
The decompression circuitry 524 reverses the lossless compression applied by the lossless memory compression circuitry 506. Optionally, an AI accelerator 526 may operate on the video stream data that is visible to the virtual machine 520 for further object detection, classification, or identification tasks.
Decrypted and decompressed video stream data is transmitted to a display controller and graphics subsystems 528 to be displayed to an end user on a display 530.
In another embodiment where blocks are encrypted using keys that are specific to the protection level assigned to the block, the virtual machine 520 may possess one or more decryption keys to decrypt content that is at or under the privilege level assigned to the virtual machine 520. Decryption may be an iterative process that attempts to decrypt each block with each key held by the virtual machine 520. Alternatively, decryption may be performed in parallel where each task or process has a separate key and block decryption is performed in parallel for a block.
In an embodiment, a virtual machine (e.g., virtual machine 520) may be used as the inference accelerator 518. For instance, the VM may execute or support classifiers, algorithms, neural networks, etc., that provide the inference accelerator 518.
The system 600 includes various components, some or all of which may be on the same printed circuit board or substrate. Components include, but are not limited to, a radio 602, battery 604, memory 606, and sensors 608A-C, which are coupled to a chip 610. Sensors 608A-C may include microphones, cameras, capacitive touch panels, or the like. The components may further be coupled to a video display 612 or speaker array 614.
Radio 602 may be configured to provide a wireless networking communication system. The wireless networking communication system may use one or more of a variety of protocols or technologies, including 3G, and 4G LTE/LTE-A, satellite communication networks, Bluetooth, near field communication (NFC), or the like.
Battery 604 may be a rechargeable battery type, (e.g., nickel-cadmium (NiCad), lead-acid, lithium ion (Li-ion), or other suitable technologies) or a non-rechargeable battery type (e.g., primary battery). Battery 604 may be used to provide power to various components of the system 600.
Memory 606 may be volatile memory (e.g., dynamic random access memory—DRAM) or non-volatile memory, such as flash memory (e.g., electrically-erasable read-only memory—EEPROM, NAND Flash, NOR Flash, etc.). Memory 606 may be used to store instructions to perform the various operations described herein. Memory 606 may also be used to store sensor data obtained by sensors 608A-C, pose data, eye tracking data, gesture data, images, and other data to provide the functions described herein.
The system 600 may include one or more sensors 608A-C, which may include, but are not limited to a microphone array, camera system, LIDAR, radar, an ultrasonic detector, an infrared detector, a motion detector, and the like. The chip 610 provides an external supply voltage (Vdd) to each of the sensors 608A-C. Various digital or analog signals may be received by the chip 610 from each of the sensors 608A-C. Sensor data may be read as raw data from the line or by using a communication protocol to package sensor data into a data structure. Sensors 608A-C may alternatively obtain power from other circuitry or power pathways than through chip 610. The camera system may be integrated with or a part of sensors 608A-C.
Cameras may be used to capture various environments such as hallways in an office building, a street view, an exterior building view, a parking lot, an airport terminal, or other areas that may be put under surveillance. While some sensor data may be obtained from sensors 608A-C that are directly wired to the chip 610, other sensor data may be obtained from other sensors. The sensor data may be obtained wirelessly using the radio 602 or through a wired connection with a network interface (not shown).
Cameras may be mounted in a computing device, such as in a laptop or mobile phone. In an embodiment, the camera system is mounted on a bezel of a laptop lid, such that when the laptop is open and is being used by a user, the camera is operable to capture the user's body position, head pose, hand gestures, or other information. Cameras may be mounted on buildings or walls as part of a surveillance system. Thus, in an embodiment, the camera system is mounted on a wall to capture people, vehicles, and other activity around the camera. Cameras may also be mounted on vehicles, either outward or inward facing. Thus, in an embodiment, the camera system is incorporated into an autonomous vehicle and may be mounted on a windshield of the autonomous vehicle and positioned to capture face and body position information of the operator of the autonomous vehicle (inward facing) or a roadway and proximate vehicles or pedestrians (outward facing).
The chip 610 may include one or more microprocessors, digital signal processors, etc. Chip 610 may contain one or more processing cores, each of which has one or more arithmetic logic units (ALU), instruction fetch units, instruction decode units, control units, registers, data stack pointers, program counters, and other essential components according to the particular architecture of the processor. As an illustrative example, chip 610 may be a system on chip (SOC) that includes multiple intellectual property (IP) blocks or IP cores. Chip 610 may include an x86-type of processor, which may be implemented as one of the IP blocks. Chip 610 may also include a graphics processing unit (CPU). Again, this may be implemented as an IP block. GPU may be a specialized co-processor that offloads certain computationally-intensive operations, particularly those associated with graphics rendering. GPU may be a separate integrated circuit, in which case chip 610 and CPU generally work collaboratively, sharing access to memory resources, I/O channels, etc. (e.g., in an SOC).
The system 600 is understood to encompass tangible entities that are physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., transitorily) configured (e.g., programmed) to operate in a specified manner or to perform part or all of any operations described herein. Such tangible entitles may be constructed using one or more circuits, such as with dedicated hardware (e.g., field programmable gate arrays (FPGAs), logic gates, graphics processing unit (GPU), a digital signal processor (DSP), etc.). As such, the tangible entities described herein may be referred to as circuits, circuitry, processor units, subsystems, or the like.
As discussed, the chip 610 may have several intellectual property (IP) blocks. IP blocks may be independent processing circuitry or reusable logic for a designated purpose. The chip 610 is able to selectively provide power to all IP block depending configuration data, state data, or other control signals.
IP blocks included on the chip 610 may include a video decode IP block 616, video processing IP block 618, and inference IP block 620. It is understood that more IP blocks may be implemented in a chip. Further, it is understood that IP blocks may be referred to as processing circuitry or processing circuits. IP blocks may include memory, instructions, processors, comparators, adders, suhtractors, transistors, and other digital circuit components to provide general processing support or specific application tasks, depending on the design of the IP block.
Video decode IP block 616 is used to decode an analog video signal and process it to a digital video signal.
Video processing IP block 618 is used to process the decoded video stream by applying a lossless compression algorithm, encrypting the compressed video stream, and assigning initial protection levels to each of the blocks in each frame of the video stream. The protection level is stored in a metadata structure in the video frame. The metadata structure may be a lossless metadata structure. The blocks are configurable in size and may be 2×2, 4×4, 8×8, 16×16, or the like.
Inference accelerator IP block 620 is used to decrypt the compressed video stream, decompress the video stream, and perform a machine-learning process on the decompressed video stream to detect and classify objects. The machine-learning process may also be configured to recognize objects, such as by using facial recognition or performing a look up in a data store (e.g., to identify a vehicle registered to a license plate that was recognized in the image).
The inference accelerator IP block 620 then assigns protection levels to image blocks based on what is contained in the image block and a security policy. The protection level is stored in a metadata structure in the video frame. The metadata structure may be a lossless metadata structure.
Virtual machines or devices that later consume the video stream may selectively decrypt portions of each frame using the protection levels assigned to each block in the frame.
At 702, a video stream is compressed using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks.
At 704, each block in each frame of the video stream is encrypted using an encryption key. In an embodiment, encrypting the video stream includes encrypting each frame in the video stream at block boundaries of the plurality of image blocks in the respective frame. In a further embodiment, the block boundaries are at 2×2 pixels, 4×4 pixels, 8×8 pixels, or 16×16 pixels.
In an embodiment, encrypting the video stream includes using an AES 128-bit cipher. In a related embodiment, encrypting the video stream comprises using an AES 256-bit cipher.
At 706, an object detection and classification process is used on the video stream to identify an object in the video stream.
At 708, a policy store is accessed to determine a corresponding protection level for the object.
At 710, The corresponding protection level is stored in lossless video compression metadata. Later, a consumer is able to access a mapping table. The mapping table is configured to store a correspondence between a protection level and the consumer. The consumer selectively decrypts image blocks of the video stream based on the protection level assigned to the consumer compared to the corresponding protection level stored in the lossless video compression metadata. In an embodiment, the consumer is a virtual machine.
In an embodiment, the method 700 includes storing, in the mapping table, a default protection level for each block in video stream. In a further embodiment, the default protection level is set to a most permissive level.
In an embodiment, before using the object detection and classification process, the video stream is decrypted using a decryption key that corresponds to the encryption key. In a further embodiment, the encryption key and the decryption are symmetric keys. In another embodiment, the method 700 includes decompressing the video stream before using the object detection and classification process.
Embodiments may be implemented in one or a combination of hardware, firmware, and software. Embodiments may also be implemented as instructions stored on a machine-readable storage device, which may be read and executed by at least one processor to perform the operations described herein. A machine-readable storage device may include any non-transitory mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a machine-readable storage device may include read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices, and other storage devices and media.
Examples, as described herein, may include, or may operate on, logic or a number of components, such as modules, intellectual property (IP) blocks or cores, or mechanisms. Such logic or components may be hardware, software, or firmware communicatively coupled to one or more processors in order to carry out the operations described herein. Logic or components may be hardware modules (e.g., IP block), and as such may be considered tangible entities capable of performing specified operations and may be configured or arranged in a certain manner. In an example, circuits may be arranged (e.g., internally or with respect to external entities such as other circuits) in a specified manner as an IP block, IP core, system-on-chip (SoC), or the like.
In an example, the whole or part of one or more computer systems (e.g., a standalone, client or server computer system) or one or more hardware processors may be configured by firmware or software (e.g., instructions, an application portion, or an application) as a module that operates to perform specified operations. In an example, the software may reside on a machine-readable medium. In an example, the software, when executed by the underlying hardware of the module, causes the hardware to perform the specified operations. Accordingly, the term hardware module is understood to encompass a tangible entity, be that an entity that is physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., transitorily) configured (e.g., programmed) to operate in a specified manner or to perform part or all of any operation described herein.
Considering examples in which modules are temporarily configured, each of the modules need not be instantiated at any one moment in time. For example, where the modules comprise a general-purpose hardware processor configured using software; the general-purpose hardware processor may be configured as respective different modules at different times. Software may accordingly configure a hardware processor, for example, to constitute a particular module at one instance of time and to constitute a different module at a different instance of time. Modules may also be software or firmware modules, which operate to perform the methodologies described herein.
An IP block (also referred to as an IP core) is a reusable unit of logic, cell, or integrated circuit. An IP block may be used as a part of a field programmable gate array (FPGA), application-specific integrated circuit (ASIC), programmable logic device (PLD), system on a chip (SoC), or the like. It may be configured for a particular purpose, such as digital signal processing or image processing. Example IP cores include central processing unit (CPU) cores, integrated graphics, security, input/output (I/O) control, system agent, graphics processing unit (CPU), artificial intelligence, neural processors, image processing unit, communication interfaces, memory controller, peripheral device control, platform controller hub, or the like.
Example computer system 800 includes at least one processor 802 (e.g., a central processing unit (CPU), a graphics processing unit (CPU) or both, processor cores, compute nodes, etc.), a main memory 804 and a static memory 806, which communicate with each other via a link 808 (e.g., bus). The computer system 800 may further include a video display unit 810, an alphanumeric input device 812 (e.g., a keyboard), and a user interface (UI) navigation device 814 (e.g., a mouse). In one embodiment, the video display unit 810, input device 812 and UI navigation device 814 are incorporated into a touch screen display. The computer system 800 may additionally include a storage device 816 (e.g., a drive unit), a signal generation device 818 (e.g., a speaker), a network interface device 820, and one or more sensors (not shown), such as a global positioning system (GPS) sensor, compass, accelerometer, or other sensor.
The storage device 816 includes a machine-readable medium 822 on which is stored one or more sets of data structures and instructions 824 (e.g., software) embodying or utilized by any one or more of the methodologies or functions described herein. The instructions 824 may also reside, completely or at least partially, within the main memory 804, static memory 806, and/or within the processor 802 during execution thereof by the computer system 800, with the main memory 804, static memory 806, and the processor 802 also constituting machine-readable media.
While the machine-readable medium 822 is illustrated in an example embodiment to be a single medium, the term “machine-readable medium” may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more instructions 824. The term “machine-readable medium” shall also be taken to include any tangible medium that is capable of storing, encoding or carrying instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure or that is capable of storing, encoding or carrying data structures utilized by or associated with such instructions. The term “machine-readable medium” shall accordingly be taken to include, but not be limited to, solid-state memories, and optical and magnetic media. Specific examples of machine-readable media include non-volatile memory, including but not limited to, by way of example, semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.
The instructions 824 may further be transmitted or received over a communications network 826 using a transmission medium via the network interface device 820 utilizing any one of a number of well-known transfer protocols (e.g., HTTP). Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, mobile telephone networks, plain old telephone (POTS) networks, and wireless data networks (e.g., Wi-Fi, 3G, and 4G LTE/LTE-A or WiMAX networks). The term “transmission medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying instructions for execution by the machine, and includes digital or analog communications signals or other intangible medium to facilitate communication of such software.
Additional Notes & ExamplesExample 1 is a system for implementing tiered access to regions of interest in video frames, comprising: a memory device to store a mapping table, the mapping table to store a correspondence between a protection level and a consumer; video processing circuitry to: compress a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks; and encrypt each block in each frame of the video stream using an encryption key; and inference circuitry to: use an object detection and classification process on the video stream to identify an object in the video stream; access a policy store to determine a corresponding protection level for the object; and store the corresponding protection level in lossless video compression metadata, wherein the consumer uses the protection level assigned to the consumer in the mapping table to selectively decrypt image blocks of the video stream based on the corresponding protection level stored in the lossless video compression metadata.
In Example 2, the subject matter of Example 1 includes, wherein the video processing circuitry is to: store, in the mapping table, a default protection level for each block in video stream.
In Example 3, the subject matter of Example 2 includes, wherein the default protection level is set to a most permissive level.
In Example 4, the subject matter of Examples 1-3 includes, wherein to encrypt the video stream, each frame in the video stream is encrypted at block boundaries of the plurality of image blocks in the respective frame.
In Example 5, the subject matter of Example 4 includes, wherein the block boundaries are at 2×2 pixels, 4×4 pixels, 8×8 pixels, or 16×16 pixels.
In Example 6, the subject matter of Examples 1-5 includes, wherein to encrypt the video stream, an AES 128-bit cipher is used.
In Example 7, the subject matter of Examples 1-6 includes, wherein to encrypt the video stream, an AES 256-bit cipher is used.
In Example 8, the subject matter of Examples 1-7 includes, wherein the inference circuitry is to, before using the object detection and classification process, decrypt the video stream using a decryption key that corresponds to the encryption key.
In Example 9, the subject matter of Example 8 includes, wherein the encryption key and the decryption are symmetric keys.
in Example 10, the subject matter of Examples 8-9 includes, wherein the inference circuitry is to decompress the video stream before using the object detection and classification process.
In Example 11, the subject matter of Examples 1-10 includes, wherein the consumer is a virtual machine.
Example 12 is a method for implementing tiered access to regions of interest in video frames, comprising: compressing a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks; encrypting each block in each frame of the video stream using an encryption key; using an object detection and classification process on the video stream to identify an object in the video stream; accessing a policy store to determine a corresponding protection level for the object; and storing the corresponding protection level in lossless video compression metadata, wherein a consumer accesses a mapping table, the mapping table to store a correspondence between a protection level and the consumer, and selectively decrypts image blocks of the video stream based on the protection level assigned to the consumer compared to the corresponding protection level stored in the lossless video compression metadata.
In Example 13, the subject matter of Example 12 includes, storing, in the mapping table, a default protection level for each block in video stream.
In Example 14, the subject matter of Example 13 includes, wherein the default protection level is set to a most permissive level.
In Example 15, the subject matter of Examples 12-44 includes, wherein encrypting the video stream comprises encrypting each frame in the video stream at block boundaries of the plurality of image blocks in the respective frame.
In Example 16, the subject matter of Example 15 includes, wherein the block boundaries are at 2×2 pixels, 4×4 pixels, 8×8 pixels, or 16×16 pixels.
In Example 17, the subject matter of Examples 12-46 includes, wherein encrypting the video stream comprises using an AES 128-bit cipher.
In Example 18, the subject matter of Examples 12-17 includes, wherein encrypting the video stream comprises using an AES 256-bit cipher.
In Example 19, the subject matter of Examples 12-18 includes, before using the object detection and classification process, decrypting the video stream using a decryption key that corresponds to the encryption key.
In Example 20, the subject matter of Example 19 includes, wherein the encryption key and the decryption are symmetric keys.
In Example 21, the subject matter of Examples 19-20 includes, decompressing the video stream before using the object detection and classification process.
In Example 22, the subject matter of Examples 12-21 includes, wherein the consumer is a virtual machine.
Example 23 is at least one machine-readable medium including instructions for implementing tiered access to regions of interest in video frames, which when executed by a machine, cause the machine to perform operations comprising: compressing a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks; encrypting each block in each frame of the video stream using an encryption key; using an object detection and classification process on the video stream to identify an object in the video stream; accessing a policy store to determine a corresponding protection level for the object; and storing the corresponding protection level in lossless video compression metadata, wherein a consumer accesses a mapping table, the mapping table to store a correspondence between a protection level and the consumer, and selectively decrypts image blocks of the video stream based on the protection level assigned to the consumer compared to the corresponding protection level stored in the lossless video compression metadata.
In Example 24, the subject matter of Example 23 includes, storing, in the mapping table, a default protection level for each block in video stream.
In Example 25, the subject matter of Example 24 includes, wherein the default protection level is set to a most permissive level.
in Example 26, the subject matter of Examples 23-25 includes, wherein encrypting the video stream comprises encrypting each frame in the video stream at block boundaries of the plurality of image blocks in the respective frame.
In Example 27, the subject matter of Example 26 includes, wherein the block boundaries are at 2×2 pixels, 4×4 pixels, 8×8 pixels, or 16×16 pixels.
In Example 28, the subject matter of Examples 23-27 includes, wherein encrypting the video stream comprises using an AES 128-bit cipher.
In Example 29, the subject matter of Examples 23-28 includes, wherein encrypting the video stream comprises using an AES 256-bit cipher.
In Example 30, the subject matter of Examples 23-29 includes, before using the object detection and classification process, decrypting the video stream using a decryption key that corresponds to the encryption key.
In Example 31, the subject matter of Example 30 includes, wherein the encryption key and the decryption are symmetric keys.
In Example 32, the subject matter of Examples 30-31 includes, decompressing the video stream before using the object detection and classification process.
in Example 33, the subject matter of Examples 23-32 includes, wherein the consumer is a virtual machine.
Example 34 is an apparatus for implementing tiered access to regions of interest in video frames, comprising: means for compressing a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks; means for encrypting each block in each frame of the video stream using an encryption key; means for using an object detection and classification process on the video stream to identify an object in the video stream; means for accessing a policy store to determine a corresponding protection level for the object; and means for storing the corresponding protection level in lossless video compression metadata, wherein a consumer accesses a mapping table, the mapping table to store a correspondence between a protection level and the consumer, and selectively decrypts image blocks of the video stream based on the protection level assigned to the consumer compared to the corresponding protection level stored in the lossless video compression metadata.
In Example 35, the subject matter of Example 34 includes, means for storing, in the mapping table, a default protection level for each block in video stream.
In Example 36, the subject matter of Example 35 includes, wherein the default protection level is set to a most permissive level.
in Example 37, the subject matter of Examples 34-36 includes, wherein the means for encrypting the video stream comprise means for encrypting each frame in the video stream at block boundaries of the plurality of image blocks in the respective frame.
In Example 38, the subject matter of Example 37 includes, wherein the block boundaries are at 2×2 pixels, 4×4 pixels, 8×8 pixels, or 16×16 pixels.
In Example 39, the subject matter of Examples 34-38 includes, wherein the means for encrypting the video stream comprise means for using an AES 128-bit cipher.
In Example 40, the subject matter of Examples 34-39 includes, wherein the means for encrypting the video stream comprise means for using an AES 256-bit cipher.
In Example 41, the subject matter of Examples 34-40 includes, means for before using the object detection and classification process, decrypting the video stream using a decryption key that corresponds to the encryption key.
In Example 42, the subject matter of Example 41 includes, wherein the encryption key and the decryption are symmetric keys.
In Example 43, the subject matter of Examples 41-42 includes, means for decompressing the video stream before using the object detection and classification process.
In Example 44, the subject matter of Examples 34-43 includes, wherein the consumer is a virtual machine.
Example 45 is at least one machine-readable medium including instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations to implement of any of Examples 1-44.
Example 46 is an apparatus comprising means to implement of any of Examples 1-44.
Example 47 is a system to implement of any of Examples 1-44.
Example 48 is a method to implement of any of Examples 1-44.
Example 49 is an edge computing system, comprising a plurality of edge computing nodes, the plurality of edge computing nodes configured with the biometric security methods of any of the examples of 1-44.
Example 50 is an edge computing node, operable in an edge computing system, comprising processing circuitry configured to implement any of the examples of 1-44.
Example 51 is art edge computing node, operable as a server in an edge computing system, configured to perform any of the examples of 1-44.
Example 52 is an edge computing node, operable as a client in an edge computing system, configured to perform any of the examples of 1-44.
Example 53 is an edge computing node, operable in a layer of an edge computing network as an aggregation node, network hub node, gateway node, or core data processing node, configured to perform any of the examples of 1-44.
Example 54 is an edge computing network, comprising networking and processing components configured to provide or operate a communications network, to enable an edge computing system to implement any of the examples of 1-44.
Example 55 is an access point, comprising networking and processing components configured to provide or operate a communications network, to enable an edge computing system to implement any of the examples of 1-44.
Example 56 is a base station, comprising networking and processing components configured to provide or operate a communications network, to enable an edge computing system to implement any of the examples of 1-44.
Example 57 is a road-side unit, comprising networking components configured to provide or operate a communications network, to enable an edge computing system to implement any of the examples of 1-44.
Example 58 is an on-premise server, operable in a private communications network distinct from a public edge computing network, the server configured to enable an edge computing system to implement any of the examples of 1-44.
Example 59 is a 3GPP 4G/LTE mobile wireless communications system, comprising networking and processing components configured with the biometric security methods of any of the examples of 1-44.
Example 60 is a 5G network mobile wireless communications system, comprising networking and processing components configured with the biometric security methods of any of the examples of 1-44.
Example 61 is a user equipment device, comprising networking and processing circuitry, configured to connect with an edge computing system configured to implement any of the examples of 1-44.
Example 62 is a client computing device, comprising processing circuitry, configured to coordinate compute operations with an edge computing system, the edge computing system configured to implement any of the examples of 1-44.
Example 63 is an edge provisioning node, operable in an edge computing system, configured to implement any of the examples of 1-44.
Example 64 is a service orchestration node, operable in an edge computing system, configured to implement any of the examples of 1-44.
Example 65 is an application orchestration node, operable in an edge computing system, configured to implement any of the examples of 1-44.
Example 66 is a multi-tenant management node, operable in an edge computing system, configured to implement any of the examples of 1-44.
Example 67 is an edge computing system comprising processing circuitry, the edge computing system configured to operate one or more functions and services to implement any of the examples of 1-44.
Example 68 is networking hardware with network functions implemented thereupon, operable within an edge computing system configured with the biometric security methods of any of examples of 1-44.
Example 69 is acceleration hardware with acceleration functions implemented thereupon, operable in an edge computing system, the acceleration functions configured to implement any of the examples of 1-44.
Example 70 is storage hardware with storage capabilities implemented thereupon, operable in an edge computing system, the storage hardware configured to implement any of the examples of 1-44.
Example 71 is computation hardware with compute capabilities implemented thereupon, operable in an edge computing system, the computation hardware configured to implement any of the examples of 1-44.
Example 72 is an edge computing system adapted for supporting vehicle-to-vehicle (V2V), vehicle-to-everything (V2X), or vehicle-to-infrastructure (V2I) scenarios, configured to implement any of the examples of 1-44.
Example 73 is an edge computing system adapted for operating according to one or more European Telecommunications Standards Institute (ETSI) Multi-Access Edge Computing (MEC) specifications, the edge computing system configured to implement any of the examples of 1-44.
Example 74 is an edge computing system adapted for operating one or more multi-access edge computing (MEC) components, the MEC components provided from one or more of: a MEC proxy, a MEC application orchestrator, a MEC application, a MEC platform, or a MEC service, according to an European Telecommunications Standards Institute (ETSI) Multi-Access Edge Computing (MEC) configuration, the MEC components configured to implement any of the examples of 1-44.
Example 75 is an edge computing system configured as an edge mesh, provided with a microservice cluster, a microservice cluster with sidecars, or linked microservice clusters with sidecars, configured to implement any of the examples of 1-44.
Example 76 is an edge computing system, comprising circuitry configured to implement one or more isolation environments provided among dedicated hardware, virtual machines, containers, virtual machines on containers, configured to implement any of the examples of 1-44.
Example 77 is an edge computing server, configured for operation as an enterprise server, roadside server, street cabinet server, or telecommunications server, configured to implement any of the examples of 1-44.
Example 78 is an edge computing system configured to implement any of the examples of 1-44 with use cases provided from one or more of: compute offload, data caching, video processing, network function virtualization, radio access network management, augmented reality, virtual reality, autonomous driving, vehicle assistance, vehicle communications, industrial automation, retail services, manufacturing operations, smart buildings, energy management, internet of things operations, object detection, speech recognition, healthcare applications, gaming applications, or accelerated content processing.
Example 79 is an edge computing system, comprising computing nodes operated by multiple owners at different geographic locations, configured to implement any of the examples of 1-44.
Example 80 is a cloud computing system, comprising data servers operating respective cloud services, the respective cloud services configured to coordinate with an edge computing system to implement any of the examples of 1-44.
Example 81 is a server, comprising hardware to operate cloudlet, edgelet, or applet services, the services configured to coordinate with an edge computing system to implement any of the examples of 1-44.
Example 82 is an edge node in an edge computing system, comprising one or more devices with at least one processor and memory to implement any of the examples of 1-44.
Example 83 is an edge node in an edge computing system, the edge node operating one or more services provided from among: a management console service, a telemetry service, a provisioning service, an application or service orchestration service, a virtual machine service, a container service, a function deployment service, or a compute deployment service, or an acceleration management service, the one or more services configured to implement any of the examples of 1-44.
Example 84 is a set of distributed edge nodes, distributed among a network layer of an edge computing system, the network layer comprising a close edge, local edge, enterprise edge, on-premise edge, near edge, middle, edge, or far edge network layer, configured to implement any of the examples of 1-44.
Example 85 is an apparatus of an edge computing system comprising: one or more processors and one or more computer-readable media comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform any of the examples of 1-44.
Example 86 is one or more computer-readable storage media comprising instructions to cause an electronic device of an edge computing system, upon execution of the instructions by one or more processors of the electronic device, to perform any of the examples of 1-44.
Example 87 is a communication signal communicated in an edge computing system, to perform any of the examples of 1-44.
Example 88 is a data structure communicated in an edge computing system, the data structure comprising a datagram, packet, frame, segment, protocol data unit (PDU), or message, to perform any of the examples of 1-44.
Example 89 is a signal communicated in an edge computing system, the signal encoded with a datagram, packet, frame, segment, protocol data unit (PDU), message, or data to perform any of the examples of 1-44.
Example 90 is an electromagnetic signal communicated in an edge computing system, the electromagnetic signal carrying computer-readable instructions, wherein execution of the computer-readable instructions by one or more processors causes the one or more processors to perform any of the examples of 1-44.
Example 91 is a computer program used in an edge computing system, the computer program comprising instructions, wherein execution of the program by a processing element in the edge computing system is to cause the processing element to perform any of the examples of 1-44.
Example 92 is an apparatus of an edge computing system comprising means to perform any of the examples of 1-44.
Example 93 is an apparatus of an edge computing system comprising logic, modules, or circuitry to perform any of the examples of 1-44.
Example 94 is at least one machine-readable medium including instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations to implement of any of Examples 48-93.
Example 95 is art apparatus comprising means to implement of any of Examples 48-93.
Example 96 is a system to implement of any of Examples 48-93.
Example 97 is a method to implement of any of Examples 48-93.
The above detailed description includes references to the accompanying drawings, which form a part of the detailed description. The drawings show, by way of illustration, specific embodiments that may be practiced. These embodiments are also referred to herein as “examples.” Such examples may include elements in addition to those shown or described. However, also contemplated are examples that include the elements shown or described. Moreover, also contemplated are examples using any combination or permutation of those elements shown or described (or one or more aspects thereof), either with respect to a particular example (or one or more aspects thereof), or with respect to other examples (or one or more aspects thereof) shown or described herein.
Publications, patents, and patent documents referred to in this document are incorporated by reference herein in their entirety, as though individually incorporated by reference. In the event of inconsistent usages between this document and those documents so incorporated by reference, the usage in the incorporated reference(s) are supplementary to that of this document; for irreconcilable inconsistencies, the usage in this document controls.
In this document, the terms “a” or “an” are used, as is common in patent documents, to include one or more than one, independent of any other instances or usages of “at least one” or “one or more.” In this document, the term “or” is used to refer to a nonexclusive or, such that “A or B” includes “A but not B,” “B but not A,” and “A and B,” unless otherwise indicated. In the appended claims, the terms “including” and “in which” are used as the plain-English equivalents of the respective terms “comprising” and “wherein.” Also, in the following claims, the terms “including” and “comprising” are open-ended, that is, a system, device, article, or process that includes elements in addition to those listed after such a term in a claim are still deemed to fall within the scope of that claim. Moreover, in the following claims, the terms “first,” “second,” and “third,” etc. are used merely as labels, and are not intended to suggest a numerical order for their objects.
The above description is intended to be illustrative, and not restrictive. For example, the above-described examples (or one or more aspects thereof) may be used in combination with others. Other embodiments may be used, such as by one of ordinary skill in the art upon reviewing the above description. The Abstract is to allow the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. Also, in the above Detailed Description, various features may be grouped together to streamline the disclosure. However, the claims may not set forth every feature disclosed herein as embodiments may feature a subset of said features. Further, embodiments may include fewer features than those disclosed in a particular example. Thus, the following claims are hereby incorporated into the Detailed Description, with a claim standing on its own as a separate embodiment. The scope of the embodiments disclosed herein is to be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.
Claims
1. A system for implementing tiered access to regions of interest in video frames, comprising:
- a memory device to store a mapping table, the mapping table to store a correspondence between a protection level and a consumer;
- video processing circuitry to: compress a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks; and encrypt each block in each frame of the video stream using an encryption key; and
- inference circuitry to: use an object detection and classification process on the video stream to identify an object in the video stream; access a policy store to determine a corresponding protection level for the object; and store the corresponding protection level in lossless video compression metadata, wherein the consumer uses the protection level assigned to the consumer in the mapping table to selectively decrypt image blocks of the video stream based on the corresponding protection level stored in the lossless video compression metadata.
2. The system of claim 1, wherein the video processing circuitry is to:
- store, in the mapping table, a default protection level for each block in video stream,
3. The system of claim 2, wherein the default protection level is set to a most permissive level.
4. The system of claim 1, wherein to encrypt the video stream, each frame in the video stream is encrypted at block boundaries of the plurality of image blocks in the respective frame.
5. The system of claim 4, wherein the block boundaries are at 2×2 pixels, 4×4 8×8 pixels, or 16×16 pixels.
6. The system of claim 1, wherein to encrypt the video stream, art AES 128-bit cipher is used.
7. The system of claim 1, wherein to encrypt the video stream, an AES 256-bit cipher is used.
8. The system of claim 1, wherein the inference circuitry is to, before using the object detection and classification process, decrypt the video stream using a decryption key that corresponds to the encryption key.
9. The system of claim 8, wherein the encryption key and the decryption are symmetric keys.
10. The system of claim 8, wherein the inference circuitry is to decompress the video stream before using the object detection and classification process.
11. The system of claim 1, wherein the consumer is a virtual machine.
12. A method for implementing tiered access to regions of interest in video frames, comprising:
- compressing a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks;
- encrypting each block in each frame of the video stream using an encryption key;
- using an object detection and classification process on the video stream to identify an object in the video stream;
- accessing a policy store to determine a corresponding protection level for the object; and
- storing the corresponding protection level in lossless video compression metadata, wherein a consumer accesses a mapping table, the mapping table to store a correspondence between a protection level and the consumer, and selectively decrypts image blocks of the video stream based on the protection level assigned to the consumer compared to the corresponding protection level stored in the lossless video compression metadata.
13. The method of claim 12, comprising storing, in the mapping table, a default protection level for each block in video stream.
14. The method of claim 13, wherein the default protection level is set to a most permissive level.
15. The method of claim 12, wherein encrypting the video stream comprises encrypting each frame in the video stream at block boundaries of the plurality of image blocks in the respective frame.
16. The method of claim 15, wherein the block boundaries are at 2×2 pixels, 4×4 pixels, 8×8 pixels, or 16×16 pixels.
17. The method of claim 12, wherein encrypting the video stream comprises using an AES 128-bit cipher.
18. The method of claim 12, wherein encrypting the video stream comprises using an AES 256-bit cipher.
19. The method of claim 12, comprising before using the object detection and classification process, decrypting the video stream using a decryption key that corresponds to the encryption key.
20. The method of claim 19, wherein the encryption key and the decryption are symmetric keys.
21. The method of claim 19, comprising decompressing the video stream before using the object detection and classification process.
22. The method of claim 12, wherein the consumer is a virtual machine.
23. At least one machine-readable medium including instructions for implementing tiered access to regions of interest in video frames, which when executed by a machine, cause the machine to perform operations comprising:
- compressing a video stream using a lossless video compression standard, the video stream comprising a plurality of frames, each frame comprising a plurality of image blocks;
- encrypting each block in each frame of the video stream using an encryption key;
- using an object detection and classification process on the video stream to identify an object in the video stream;
- accessing a policy store to determine a corresponding protection level for the object; and
- storing the corresponding protection level in lossless video compression metadata, wherein a consumer accesses a mapping table, the mapping table to store a correspondence between a protection level and the consumer, and selectively decrypts image blocks of the video stream based on the protection level assigned to the consumer compared to the corresponding protection level stored in the lossless video compression metadata.
24. The at least one machine-readable medium claim 23, comprising storing, in the mapping table, a default protection level for each block in video stream.
25. The at least one machine-readable medium of claim 24, wherein the default protection level is set to a most permissive level.
Type: Application
Filed: Dec 22, 2020
Publication Date: May 20, 2021
Inventors: Praveen Prasad Nair (Gilbert, AZ), Steven J. Tu (Phoenix, AZ), Lawrence A Booth, JR. (Phoenix, AZ), Werner Adam Metz, JR. (Chandler, AZ)
Application Number: 17/131,417
